* Change production example to be an integration test
The documentation is a better example then the test now. Separate the
two.
Signed-off-by: Kevin Fox <[email protected]>
* Fix job name reference
Signed-off-by: Kevin Fox <[email protected]>
* Fix job name reference
Signed-off-by: Kevin Fox <[email protected]>
* Update postgresql example
Signed-off-by: Kevin Fox <[email protected]>
* Update mysql example
Signed-off-by: Kevin Fox <[email protected]>
* Update nested and mysql
Signed-off-by: Kevin Fox <[email protected]>
* Fix typo
Signed-off-by: Kevin Fox <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue
Signed-off-by: Kevin Fox <[email protected]>
* Try folding example your values into bash so that its not laying around in an fs for a user to accidently use.
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Fix test
Signed-off-by: Kevin Fox <[email protected]>
* Cleanup
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Add direct tpm support for spire-agent
Signed-off-by: Kevin Fox <[email protected]>
* Add fingerprinting support
Signed-off-by: Kevin Fox <[email protected]>
* Add example
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Support hybrid nodes with different attestors
In some clusters, you may have a mix of nodes with differing attestor
needs. For example, some nodes have hardware TPMs and some without.
This patch enables configuring multiple daemonsets for the agent
that you can target to pools of nodes.
Signed-off-by: Kevin Fox <[email protected]>
* Remove extra slash
Signed-off-by: Kevin Fox <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-agent/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
* Fix broken tests
Signed-off-by: Kevin Fox <[email protected]>
* Add daemonset labels
Signed-off-by: Kevin Fox <[email protected]>
* Add temporary upgrade hook
Signed-off-by: Kevin Fox <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Fix include
Signed-off-by: Kevin Fox <[email protected]>
* Add missing values
Signed-off-by: Kevin Fox <[email protected]>
* Fix perms, add upgrade note
Signed-off-by: Kevin Fox <[email protected]>
* Fix hardcoded nodeAttestor and keyManager in spire-agent
Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge issues
Signed-off-by: Kevin Fox <[email protected]>
* Fix unit tests
Signed-off-by: Kevin Fox <[email protected]>
* Pass the agent's securityContext on to Kubernetes
Currently its ignored.
Signed-off-by: Kevin Fox <[email protected]>
* Update example to be usable
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Update example
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict issue
Signed-off-by: Kevin Fox <[email protected]>
* Update to the newest release
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Signed-off-by: kfox1111 <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix version numbers in docs
Signed-off-by: Kevin Fox <[email protected]>
* Remove merge conflicted extra code
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Complete Server K8S PSAT support
Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict
Signed-off-by: Kevin Fox <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
* Add basic psat test
Signed-off-by: Kevin Fox <[email protected]>
* Fix linter
Signed-off-by: Kevin Fox <[email protected]>
* Fix up test
Signed-off-by: Kevin Fox <[email protected]>
* Add missing file
Signed-off-by: Kevin Fox <[email protected]>
* Better encode config
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Add external k8s bundler
Adds support to sync the CA bundle to configmaps in external
Kubernetes clusters
Signed-off-by: Kevin Fox <[email protected]>
* Update default
Signed-off-by: Kevin Fox <[email protected]>
* Fix config file layout. Incorperate feedback.
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Update based on parent pr feedback
Signed-off-by: Kevin Fox <[email protected]>
* Reformat config file
Signed-off-by: Kevin Fox <[email protected]>
* Fix some things
Signed-off-by: Kevin Fox <[email protected]>
* Reconfigure kind
Signed-off-by: Kevin Fox <[email protected]>
* More debugging
Signed-off-by: Kevin Fox <[email protected]>
* Fix up kind
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Complete Server K8S PSAT support
Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the
ease of use for configuring local cluster support while adding the ability to configure
multiple/external clusters as well. Kubeconfig support is added in its own config block
as it will be used/shared with spire-controller-manager support in the future.
Signed-off-by: Kevin Fox <[email protected]>
* Fix merge conflict
Signed-off-by: Kevin Fox <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
* Add basic psat test
Signed-off-by: Kevin Fox <[email protected]>
* Fix linter
Signed-off-by: Kevin Fox <[email protected]>
* Fix up test
Signed-off-by: Kevin Fox <[email protected]>
* Add missing file
Signed-off-by: Kevin Fox <[email protected]>
* Better encode config
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
* Apply suggestions from code review
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/values.yaml
Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
* Fix docs
Signed-off-by: Kevin Fox <[email protected]>
* Update default
Signed-off-by: Kevin Fox <[email protected]>
* Fix config file layout. Incorperate feedback.
Signed-off-by: Kevin Fox <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
* Fix up kind
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Use github app for version checker
Signed-off-by: Faisal Memon <[email protected]>
* Use full version
Signed-off-by: Faisal Memon <[email protected]>
---------
Signed-off-by: Faisal Memon <[email protected]>
A duplicate section was added due to incorrect merge conflict resolution.
Helm seems ok with it but Kustomize + FluxCD has issues with it.
Signed-off-by: Kevin Fox <[email protected]>
* beda725 Add pod labels to the SPIRE agent (#273)
* 077f152 Bump test chart dependencies (#272)
* 5849ea2 add pod labels to spire server values (#271)
* f512b06 Configurable daemonsets updateStrategy (#212)
* a539065 Add direct tpm support for spire-agent (#216)
* fcd0c11 Add direct tpm support for spire-server (#211)
* c570174 Enable CA settings via global (#268)
* ac83694 Initial SPIRE 1.9.0 support (#262)
* ddb4eff Bump test chart dependencies (#263)
* bfbafbc Fix OpenShift Federation Ingress bug (#260)
* a0baace Upgrade to spire-controller-manager 0.4.3 (#258)
* 1446f7e Add support for specifying agent authorized_delegates (#255)
* 0b6cd88 Add support for specifying server admin_ids (#254)
* 07a1c39 Add global override for kubectl tag (#251)
* b82a84d Bump test chart dependencies (#252)
* 7a1e731 Bump test chart dependencies (#246)
* a706063 make audit_log_enabled configurable (#241)
* 34a39cb Added emptyDir volume to spire-agent SCC (#243)
* a2e5a4e Add support for enabling the spire-agent admin socket (#234)
* febdcbf Fix whitespace in spire-agent daemonset
Signed-off-by: Faisal Memon <[email protected]>
* Configure daemonsets updateStrategy
This allows more deamonset pods to be rotated in the same time. This speeds up the updates
Signed-off-by: Marco Franssen <[email protected]>
* Incorperate feedback
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
Adds a global.spire.caSubject section where you can set the CA
subject information for all spire-server instances.
Signed-off-by: Kevin Fox <[email protected]>
* Add support for specifying server admin_ids
Signed-off-by: Kevin Fox <[email protected]>
* Update charts/spire/charts/spire-server/templates/configmap.yaml
Signed-off-by: kfox1111 <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Add support for integration tests in the tests/integration dir
Signed-off-by: Kevin Fox <[email protected]>
* Fix split issue and typo
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Kevin Fox <[email protected]>
* Add example for using Spire for mTLS with Keycloak
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
* Minor improvement to the README.md
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
* But I still need to learn GitHub Markdown format
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
* Make it more obvious that it works without a (correct) password
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
* Add warning for Kubernetes 1.29+ feature
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
* Move ghostunnel into an initContainer with restartPolicy=Always
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
* Apply suggestions from code review
Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
* Move java-spiffe-helper-properties into extraDeploy of the Keycloak chart and pin node version to it has a matching rancher/kubectl image
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
---------
Signed-off-by: Moritz Schmitz von Hülst <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Faisal Memon